Try disabling counters. They lose synchronization specially when agents are reinstalled.
Edit /var/ossec/etc/internal_options.conf and set "remoted.verify_msg_id=0" Then restart ossec manager. On Mon, Dec 14, 2015 at 9:43 AM, Jamey B <[email protected]> wrote: > Hi everyone, > > I'm in a corporate environment, the environment we are deploying OSSEC to > has around 1000 servers (I did the manual install and increased the agent > limit). The firewall is allowing all UDP and TCP ports to pass through for > our deployment. No traffic is being blocked to/from the OSSEC manager. > > We distributed OSSEC to an environment via Puppet and are able to get the > agents to grab a client key over port 1515, but they are having issues > connecting. A handful do eventually connect, but the majority don't, I > don't see them come up in the OSSEC logs but they do appear as inactive > agents. > > > Any ideas as to why the majority of agents are not connecting, but do get > their keys? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
